- Children under 16 will no longer be allowed to register social media accounts on covered platforms.
- Platforms must introduce age verification measures to identify underage users.
- Existing users may also be required to verify their age.
- Facebook, Instagram, TikTok and YouTube are among the platforms affected.
- Companies that fail to comply could face penalties of up to RM10 million.
KUALA LUMPUR, June 1 — Malaysia’s new Child Protection Code (CPC) under the Online Safety Act 2025 (ONSA) takes effect today, bringing new obligations for major social media platforms operating in the country.
Among the biggest changes is a requirement for platforms to verify users’ ages and prevent children under 16 from registering social media accounts.
The code, issued by the Malaysian Communications and Multimedia Commission (MCMC), applies to licensed social media platforms with at least eight million users in Malaysia, including platforms such as Facebook, Instagram, TikTok and YouTube.
Here is what users and parents need to know about the new rules.
What is the Child Protection Code?
The CPC is a regulatory code issued under the Online Safety Act 2025.
The code sets out measures that licensed online service providers must implement to ensure safer online use for children, including:
- Age verification;
- Privacy and safety settings;
- Content moderation;
- Recommendation algorithms;
- Parental control tools; and
- Restrictions on harmful or exploitative interactions.
MCMC said the code is part of a broader effort to strengthen online safety protections for children and other vulnerable users.
What is changing from June 1?
The main change is that social media platforms covered by the code will be expected to stop users below 16 from registering social media accounts.
Platforms must introduce age verification measures to determine whether users are at least 16 years old before allowing account registration or access to certain features.
MCMC has said a grace period will be provided to allow platforms time to implement and complete the verification process.
Which platforms are affected?
The requirements apply to licensed social media service providers with at least eight million users in Malaysia.
The FAQ specifically names:
- Facebook;
- Instagram;
- TikTok; and
- YouTube.
MCMC has also said additional platforms may later be brought under the rules if necessary.
Does this mean children are banned from the internet?
No.
The FAQ states that the measure is not intended to prohibit children from using the internet or technology.
Instead, the policy is focused specifically on social media account registration and access to age-appropriate features.
The regulator also said parents and guardians continue to play an important role in supervising children’s online activity.
Why was the minimum age set at 16?
MCMC said the age threshold reflects concerns about children’s exposure to online harms and considerations related to cognitive and emotional development.
Users aged 16 are generally better able to assess risks, manage online interactions and exercise judgement in digital environments.
How will age verification work?
Both new and existing users may be required to verify their ages. This includes existing child users who already have social media accounts.
Users who do not complete the process could face restrictions, including being unable to create accounts or losing access to certain features.
The government has not prescribed a single technology or verification method. Instead, Malaysia is using what MCMC describes as a “technology-neutral” and “outcome-based” approach.
This means platforms can choose their own verification systems, provided they meet requirements related to effectiveness, privacy and security.
Platforms may verify users against government-issued records such as:
- MyKad;
- Passports; or
- Other documents recognised by Malaysian authorities or equivalent foreign authorities.
However, MCMC has not announced a standard verification process that all platforms must follow.
The FAQ does not specifically state whether users will be required to upload identification documents. It only states that verification measures may involve checks against government-issued records, depending on the systems adopted by individual platforms.
Platforms must also clearly explain:
- What information users need to provide;
- How the verification process works; and
- How users’ personal information will be handled.
What about privacy?
MCMC said age verification measures must comply with Malaysian data protection laws and regulatory requirements.
The regulator also said platforms should only collect information necessary for verification purposes.
According to the FAQ, personal information gathered for age verification must:
- Be used only for verification purposes; and
- Be handled securely.
Communications Minister Datuk Fahmi Fadzil previously said the Personal Data Protection Act already applies to the handling of Malaysians’ personal data.
He noted that similar verification approaches are already used in other sectors, including e-wallet services.
Deputy Communications Minister Teo Nie Ching also said the personal information gathered would only be used for age verification.
“After that, we will not collect information on who the account user is, who the account owner is, or what their name is...the process is only limited to age verification,” she said in the Dewan Rakyat in January.
What if children simply use their parents’ accounts?
MCMC acknowledges this is a possibility, but cautioned that it remains a risk.
The code therefore expects platforms to introduce “reasonable and proportionate measures” to detect and prevent misuse of adult accounts by children.
This may include monitoring suspicious account behaviour.
What other protections are included in the code?
Beyond age verification, the CPC requires platforms to introduce stronger safeguards for child users.
- Privacy settings by default
Platforms must ensure child users receive the highest or most age-appropriate privacy and safety settings automatically.
- Restrictions on adult-child communication
Platforms must restrict or prohibit direct communication between child users and unrelated adult users.
- Safer recommendation systems
Platforms must ensure search and recommendation algorithms do not promote harmful content to child users.
Safe search functions must also be switched on by default.
- Parental controls
Platforms must provide parental control tools allowing parents to monitor and manage children’s online activities.
These tools must be user-friendly and easy to access.
Some platforms already offer such features. TikTok’s Family Pairing tool, for example, allows parents to link their account to a teenager’s account and manage screen time limits, direct messages, content filters and privacy settings.
- Harmful content reporting
Platforms must provide clear reporting systems for harmful content affecting children.
They are also expected to respond quickly to requests from authorities to remove harmful content.
What counts as harmful content?
Under the code, harmful content includes:
- Child sexual abuse material;
- Financial fraud;
- Obscene or indecent content;
- Harassment-related content;
- Violent or terrorism-related material;
- Content encouraging self-harm;
- Content promoting hostility; and
- Content promoting dangerous drugs.
What happens if platforms do not comply?
Platforms that fail to comply with the CPC may face regulatory action under the Online Safety Act 2025.
This could include fines or financial penalties of up to RM10 million.
However, MCMC said parents and guardians will not face penalties for non-compliance.
Is Malaysia alone in introducing such measures?
No.
Countries such as Australia, Brazil and Indonesia have introduced or announced similar age-restriction measures, while several others are studying comparable frameworks.
Malaysia’s approach is aligned with broader international developments on online safety and child protection.
What should parents and users do now?
For now, users do not need to take any immediate action.
MCMC has said platforms will be given time to implement age verification systems, with individual companies expected to announce their own verification processes and timelines.
Parents, however, are encouraged to remain actively involved in monitoring their children's online activities, as age verification is only one part of the broader child safety framework.
